
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
spacy-legacy
Advanced tools
This package includes outdated registered functions for spaCy v3.x, for example model architectures, pipeline components and utilities. It's installed automatically as a dependency of spaCy, and allows us to provide backwards compatibility, while keeping the core library tidy and up to date. All of this happens under the hood, so you typically shouldn't have to care about this package.
Whenever a new backwards-incompatible version of a registered function is available, e.g. spacy.Tok2Vec.v1 → spacy.Tok2Vec.v2, the legacy version is moved to spacy-legacy, and exposed via entry points. This means that it will still be available if your config files use it, even though the core library only includes the latest version.
Legacy functions are exposed with the prefix spacy-legacy, e.g. spacy-legacy.Tok2Vec.v1. When spaCy resolves your config and a function is not available in the core library, e.g. spacy.Tok2Vec.v1, it will check if there's a legacy function available and fall back to that. You can also explicitly refer to legacy functions in your config, to indicate that a newer version is available.
FAQs
Legacy registered functions for spaCy backwards compatibility
We found that spacy-legacy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.